Skip to content

Commit aa557cf

Browse files
NapalysNapalys
committed
JS: Added tests for DotRemovingReplaceCall with RegExp Object.
1 parent a0df33c commit aa557cf

File tree

3 files changed

+133
-0
lines changed

3 files changed

+133
-0
lines changed

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/Consistency.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
| TaintedPath.js:213 | expected an alert, but found none | NOT OK (can be absolute) | |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.expected

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1619,6 +1619,60 @@ nodes
16191619
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
16201620
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
16211621
| TaintedPath.js:206:29:206:85 | path.re ... '), '') |
1622+
| TaintedPath.js:211:7:211:48 | path |
1623+
| TaintedPath.js:211:7:211:48 | path |
1624+
| TaintedPath.js:211:7:211:48 | path |
1625+
| TaintedPath.js:211:7:211:48 | path |
1626+
| TaintedPath.js:211:7:211:48 | path |
1627+
| TaintedPath.js:211:7:211:48 | path |
1628+
| TaintedPath.js:211:7:211:48 | path |
1629+
| TaintedPath.js:211:7:211:48 | path |
1630+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1631+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1632+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1633+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1634+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1635+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1636+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1637+
| TaintedPath.js:211:14:211:37 | url.par ... , true) |
1638+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1639+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1640+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1641+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1642+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1643+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1644+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1645+
| TaintedPath.js:211:14:211:43 | url.par ... ).query |
1646+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1647+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1648+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1649+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1650+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1651+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1652+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1653+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path |
1654+
| TaintedPath.js:211:24:211:30 | req.url |
1655+
| TaintedPath.js:211:24:211:30 | req.url |
1656+
| TaintedPath.js:211:24:211:30 | req.url |
1657+
| TaintedPath.js:211:24:211:30 | req.url |
1658+
| TaintedPath.js:211:24:211:30 | req.url |
1659+
| TaintedPath.js:216:31:216:34 | path |
1660+
| TaintedPath.js:216:31:216:34 | path |
1661+
| TaintedPath.js:216:31:216:34 | path |
1662+
| TaintedPath.js:216:31:216:34 | path |
1663+
| TaintedPath.js:216:31:216:34 | path |
1664+
| TaintedPath.js:216:31:216:34 | path |
1665+
| TaintedPath.js:216:31:216:34 | path |
1666+
| TaintedPath.js:216:31:216:34 | path |
1667+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1668+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1669+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1670+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1671+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1672+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1673+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1674+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
1675+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') |
16221676
| examples/TaintedPath.js:8:7:8:52 | filePath |
16231677
| examples/TaintedPath.js:8:7:8:52 | filePath |
16241678
| examples/TaintedPath.js:8:7:8:52 | filePath |
@@ -6910,6 +6964,70 @@ edges
69106964
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69116965
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
69126966
| TaintedPath.js:206:29:206:32 | path | TaintedPath.js:206:29:206:85 | path.re ... '), '') |
6967+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6968+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6969+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6970+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6971+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6972+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6973+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6974+
| TaintedPath.js:211:7:211:48 | path | TaintedPath.js:216:31:216:34 | path |
6975+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6976+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6977+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6978+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6979+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6980+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6981+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6982+
| TaintedPath.js:211:14:211:37 | url.par ... , true) | TaintedPath.js:211:14:211:43 | url.par ... ).query |
6983+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6984+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6985+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6986+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6987+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6988+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6989+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6990+
| TaintedPath.js:211:14:211:43 | url.par ... ).query | TaintedPath.js:211:14:211:48 | url.par ... ry.path |
6991+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6992+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6993+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6994+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6995+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6996+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6997+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6998+
| TaintedPath.js:211:14:211:48 | url.par ... ry.path | TaintedPath.js:211:7:211:48 | path |
6999+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7000+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7001+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7002+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7003+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7004+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7005+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7006+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7007+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7008+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7009+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7010+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7011+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7012+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7013+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7014+
| TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:211:14:211:37 | url.par ... , true) |
7015+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7016+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7017+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7018+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7019+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7020+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7021+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7022+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7023+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7024+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7025+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7026+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7027+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7028+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7029+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
7030+
| TaintedPath.js:216:31:216:34 | path | TaintedPath.js:216:31:216:69 | path.re ... '), '') |
69137031
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
69147032
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
69157033
| examples/TaintedPath.js:8:7:8:52 | filePath | examples/TaintedPath.js:11:36:11:43 | filePath |
@@ -10730,6 +10848,7 @@ edges
1073010848
| TaintedPath.js:197:45:197:48 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:197:45:197:48 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1073110849
| TaintedPath.js:198:35:198:38 | path | TaintedPath.js:195:24:195:30 | req.url | TaintedPath.js:198:35:198:38 | path | This path depends on a $@. | TaintedPath.js:195:24:195:30 | req.url | user-provided value |
1073210850
| TaintedPath.js:206:29:206:85 | path.re ... '), '') | TaintedPath.js:202:24:202:30 | req.url | TaintedPath.js:206:29:206:85 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:202:24:202:30 | req.url | user-provided value |
10851+
| TaintedPath.js:216:31:216:69 | path.re ... '), '') | TaintedPath.js:211:24:211:30 | req.url | TaintedPath.js:216:31:216:69 | path.re ... '), '') | This path depends on a $@. | TaintedPath.js:211:24:211:30 | req.url | user-provided value |
1073310852
| examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | examples/TaintedPath.js:8:28:8:34 | req.url | examples/TaintedPath.js:11:29:11:43 | ROOT + filePath | This path depends on a $@. | examples/TaintedPath.js:8:28:8:34 | req.url | user-provided value |
1073410853
| express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | express.js:8:20:8:32 | req.query.bar | This path depends on a $@. | express.js:8:20:8:32 | req.query.bar | user-provided value |
1073510854
| handlebars.js:11:32:11:39 | filePath | handlebars.js:29:46:29:60 | req.params.path | handlebars.js:11:32:11:39 | filePath | This path depends on a $@. | handlebars.js:29:46:29:60 | req.params.path | user-provided value |

‎javascript/ql/test/query-tests/Security/CWE-022/TaintedPath/TaintedPath.js

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,3 +206,16 @@ var server = http.createServer(function(req, res) {
206206
res.write(fs.readFileSync(path.replace(new RegExp("[\\]\\[*,;'\"`<>\\?/]", ''), ''))); // NOT OK.
207207
res.write(fs.readFileSync(path.replace(new RegExp("[\\]\\[*,;'\"`<>\\?/]", unknownFlags()), ''))); // OK -- Might be okay depending on what unknownFlags evaluates to.
208208
});
209+
210+
var server = http.createServer(function(req, res) {
211+
let path = url.parse(req.url, true).query.path;
212+
213+
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // NOT OK (can be absolute) -- Currently not flagged because it is not a literal
214+
215+
if (!pathModule.isAbsolute(path)) {
216+
res.write(fs.readFileSync(path.replace(new RegExp("[.]", ''), ''))); // NOT OK
217+
res.write(fs.readFileSync(path.replace(new RegExp("[.]", 'g'), ''))); // OK
218+
res.write(fs.readFileSync(path.replace(new RegExp("[.]", unknownFlags()), ''))); // OK
219+
}
220+
});
221+

0 commit comments

Comments
 (0)